Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,434
Total alertas
3054
Críticas
10108
Altas
8
Ransomware
1778
Esta semana
RSS
M Crítico vulnerabilidad
Hace 3 días
[CVE-2026-66309] Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges ov…
Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
Hace 3 días
[CVE-2026-66788] A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vu…
A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespa…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-76310] In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who …
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect system integrity, including by performing administrative actions when the owner holds the "admin" Splunk r…
nvdcriticovulnerabilidad CVSS 9.4 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-76311] In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who …
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the Splunk platform instance. The vulnerability is possible because the embedded report authorization flow do…
nvdcriticovulnerabilidad CVSS 9.4 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-76312] In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who …
In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (HTML) source of a page that embeds a Splunk report could use exposed session material to access all relevant data and affect system integrity. The vulnerability is possible because the dispatch archive download path does not correctly enforce the embedded-repo…
nvdcriticovulnerabilidad CVSS 9.4 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-20315] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Wo…
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20315 are related to improper access control issues that are …
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
Hace 5 días
[CVE-2026-18776] The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of i…
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
Hace 5 días
[CVE-2026-66780] A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, whi…
A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
Hace 5 días
[CVE-2026-74979] Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Fir…
Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
16/08/2026
[CVE-2026-73061] Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that al…
Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
12/08/2026
[CVE-2026-16538] The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collec…
The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
10/08/2026
Vulnerabilidad crítica de autorización en daptin v0.12.34 permite acceso no autenticado
Daptin versiones hasta v0.12.34 contiene un defecto en validación de permisos que permite a atacantes no autenticados leer, crear, modificar y eliminar registros de grupos de usuarios. La falla afecta las funciones de control de acceso en server/permission/permission.go, que no rechaza referencias nulas/cero. Empresas en LATAM que despleguen daptin en sistemas de gestión de datos o APIs internas están en riesgo inmediato de exposición de información sensible y manipulación de estructura organizacional.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
07/08/2026
[CVE-2026-56161] Improper access control in Azure Logic Apps allows an authorized attacker to disclose information ov…
Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2025-14561] In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. Thi…
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is …
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Crítico vulnerabilidad
05/08/2026
[CVE-2026-20304] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst …
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20304 are related to improper access control issues that are gr…
nvdcriticovulnerabilidad CVSS 9.9 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
05/08/2026
[CVE-2026-20267] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE So…
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20267 are related to improper access control issues that ar…
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2026-66803] Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a ne…
Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-41920] Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic S…
Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
28/07/2026
[CVE-2026-64863] goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, th…
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2021-32084] An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer res…
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API, leading to a potential compromise of the entire environment that is configured for KACE.
nvdcriticovulnerabilidad CVSS 9.8 NVD